Webkul vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-95655 Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages.High 8.6 · Sep 22, 2026
• CVE-2026-93988 QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read aHigh 7.1 · Sep 19, 2026
• CVE-2026-75498 Webkul QloApps does not validate request parameters before a database query.High 8.6 · Aug 25, 2026
• CVE-2026-75497 Webkul QloApps does not validate request parameters before a database query.High 8.6 · Aug 25, 2026
• CVE-2026-75496 Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory.High 8.6 · Aug 25, 2026
• CVE-2026-9506 This vulnerability exists in Bagisto due to improper validation of user-supplied input in the ImageCacheController component.High 8.7 · Jun 8, 2026
• CVE-2026-38532 A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to aHigh 8.1 · Apr 14, 2026
• CVE-2026-38530 A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arHigh 8.1 · Apr 14, 2026
• CVE-2026-38529 A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarilHigh 8.8 · Apr 14, 2026
• CVE-2025-67325 Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code executCritical 9.8 · Jan 8, 2026
• CVE-2025-60880 An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file conHigh 8.3 · Oct 10, 2025
• CVE-2024-46367 A Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to inject arbitrary JavaScript code by submitting a malicioCritical 9.6 · Sep 27, 2024
• CVE-2024-46366 A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template code by injecHigh 8.8 · Sep 27, 2024
• CVE-2024-40318 An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file.High 7.2 · Jul 25, 2024
• CVE-2024-0916 Unauthenticated file upload allows remote code execution.Critical 10 · Apr 25, 2024
• CVE-2023-51210 SQL injection vulnerability in Webkul Bundle Product 6.0.1 allows a remote attacker to execute arbitrary code via the id_product parameters in the UpdateProductCritical 9.8 · Jan 23, 2024
• CVE-2023-39147 An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file.High 7.8 · Aug 1, 2023
• CVE-2023-33570 Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI).High 8.8 · Jun 28, 2023
• CVE-2023-36284 An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypasHigh 7.5 · Jun 23, 2023
• CVE-2019-16403 In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can also be manipulated by High 8.8 · Sep 18, 2019
• CVE-2019-14933 Bagisto 0.1.5 allows CSRF under /admin URIs.High 8.8 · Aug 11, 2019